Fetch Markdown Block Content Through The Backend - #261
Conversation
honzatmn
left a comment
honzatmn
left a comment
There was a problem hiding this comment.
Looks good. Just commenting without explicit approve, so we don't accidentally merge it to master before backend is on prod too.
| let html = converter.makeHtml(markdown) | ||
| return `<div class="markdown">${html}</div>` | ||
| let html = converter.makeHtml(markdown); | ||
| return `<div class="markdown">${sanitizeHtml(html, MARKDOWN_SANITIZE_OPTIONS)}</div>`; |
There was a problem hiding this comment.
Added sanitization of HTML for rendering. Same lib, logic and rules should be applied also in cloud editor markdown rendering
|
Latest changes in 14ec539:
|
The shim covered sanitize-html's entities dependency, which is gone since the switch to rehype-sanitize; nothing in the bundle references a global atob anymore (js-base64 carries its own polyfill). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
| src: ['http', 'https'], | ||
| }, | ||
| // Keep ids as authored, the rendered page is not user-controlled enough to need clobbering | ||
| clobber: [], |
There was a problem hiding this comment.
isn't it? like user can add whatever to the markdown
| {* Download markdown data *} | ||
| {[ let markdownData = getNetworkData(url, settings) /]} | ||
| {[ if isNonEmptyString(markdownData) ]} | ||
| {[ if isNonEmptyString(markdownData.content) ]} |
There was a problem hiding this comment.
this might fail if ds.markdownFromUrl returns null
| * (packages/editor/src/utils/markdown/markdownSanitizeSchema.ts) so the editor | ||
| * preview and published docs sanitize identically. Update both together. | ||
| */ | ||
| const MARKDOWN_SANITIZE_SCHEMA: SanitizeSchema = { |
There was a problem hiding this comment.
since we are not extending but replacing default schema, shouldn't we include strip for "script" and "style"?
| "source_dir": "src", | ||
| "assets_dir": "assets", | ||
| "version": "5.6.4", | ||
| "version": "5.7.0", |
There was a problem hiding this comment.
do we need to keep the markdown token here since it won't be used anymore ? If it is migrated and it should not be provided in the settings anymore then we might remove it from here 🤔 can be separate PR
3 participants
Fixes RCT-9896
The markdown block now fetches content through the Supernova backend instead of downloading remote files directly.
Changes
page_block_custom_markdown.prcalls the new Pulsar functionds.markdownFromUrl(url)(backendPOST /markdown/from-urlwithforceUpdate: false) instead ofgetNetworkData()Blocked by